CVE-2021-21684

Опубликовано: 06 окт. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

Ссылки

http://www.openwall.com/lists/oss-security/2021/10/06/1
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499
Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/10/06/1
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:git:*:*:*:*:*:jenkins:*:*

Версия до 4.8.2 (включая)

EPSS

Процентиль: 41%

0.00193

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-116

Связанные уязвимости

CVE-2021-21684

CVSS3: 6.1

redhat

больше 4 лет назад

GHSA-gghc-g8cj-4vfv

CVSS3: 6.1

github

больше 3 лет назад

Stored XSS vulnerability in Jenkins Git Plugin

EPSS

Процентиль: 41%

0.00193

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-116